Data portability is a concept to protect users from having their data stored in "silos" or "walled gardens" that are incompatible with one another, i.e.
closed platform
A closed platform, walled garden, or closed ecosystem is a software system wherein the carrier or service provider has control over applications, content, and/or media, and restricts convenient access to non-approved applicants or content. This ...
s, thus subjecting them to
vendor lock-in
In economics, vendor lock-in, also known as proprietary lock-in or customer lock-in, makes a customer dependent on a vendor for products, unable to use another vendor without substantial switching costs.
The use of open standards and alternat ...
and making the creation of
data backup
In information technology, a backup, or data backup is a copy of computer data taken and stored elsewhere so that it may be used to restore the original after a data loss event. The verb form, referring to the process of doing so, is "back up", ...
s or moving accounts between services difficult.
Data portability requires common
technical standard
A technical standard is an established norm or requirement for a repeatable technical task which is applied to a common and repeated use of rules, conditions, guidelines or characteristics for products or related processes and production methods, ...
s to facilitate the transfer from one data controller to another, such as the ability to
export
An export in international trade is a good produced in one country that is sold into another country or a service provided in one country for a national or resident of another country. The seller of such goods or the service provider is an ...
user data into a user-accessible local file, thus promoting
interoperability
Interoperability is a characteristic of a product or system to work with other products or systems. While the term was initially defined for information technology or systems engineering services to allow for information exchange, a broader defi ...
, as well as facilitate searchability with sophisticated tools such as
grep
grep is a command-line utility for searching plain-text data sets for lines that match a regular expression. Its name comes from the ed command ''g/re/p'' (''globally search for a regular expression and print matching lines''), which has the sa ...
.
Data portability applies to personal data. It involves access to the personal data without implying data ownership per se.
Development
At the global level there are proponents who see the protection of digital data as a human right. Thus, in an emerging civil society draft declaration, one finds mention of the following concepts and statutes: Right to Privacy on the Internet, Right to Digital Data Protection, Rights to Consumer Protection on the Internet – United Nations Guidelines for Consumer Protection.
At the regional level there are at least three main jurisdictions where data rights are seen differently: China and India, the United States and the European Union. In the latter, personal data was given special protection under the 2018
General Data Protection Regulation (GDPR).
The GDPR thus became the fifth of the 24 types of legislation listed in Annex 1 Table of existing and proposed European Directives and Regulations in relation to data.
Personal data are the basis for
behavioral advertising
Targeted advertising is a form of advertising, including online advertising, that is directed towards an audience with certain traits, based on the product or person the advertiser is promoting. These traits can either be demographic with a focus ...
, and early in the 21st century their value began to grow exponentially, at least as measured in the market capitalization of the major platforms holding personal data on their respective users. European Union regulators reacted to this perceived power imbalance between platforms and users, although much still hinges on the terms of consent given by users to the platforms. The concept of data portability comprises an attempt to correct the perceived power imbalance by introducing an element of competition allowing users to choose among platforms.
Online platforms
With the advent of the
General Data Protection Regulations (GDPR),
social media platform
Social media are interactive media technologies that facilitate the creation and sharing of information, ideas, interests, and other forms of expression through virtual communities and networks. While challenges to the definition of ''social med ...
s such as
Twitter
Twitter is an online social media and social networking service owned and operated by American company Twitter, Inc., on which users post and interact with 280-character-long messages known as "tweets". Registered users can post, like, and ...
,
Instagram
Instagram is a photo and video sharing social networking service owned by American company Meta Platforms. The app allows users to upload media that can be edited with filters and organized by hashtags and geographical tagging. Posts can ...
and
Snapchat
Snapchat is an American multimedia instant messaging app and service developed by Snap Inc., originally Snapchat Inc. One of the principal features of Snapchat is that pictures and messages are usually only available for a short time before the ...
have widely adapted the ability to export and download user data into a
ZIP archive file
In computing, an archive file is a computer file that is composed of one or more files along with metadata. Archive files are used to collect multiple data files together into a single file for easier portability and storage, or simply to compre ...
. Other platforms such as
Google
Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. ...
and
Facebook
Facebook is an online social media and social networking service owned by American company Meta Platforms. Founded in 2004 by Mark Zuckerberg with fellow Harvard College students and roommates Eduardo Saverin, Andrew McCollum, Dustin M ...
already were equipped with export options earlier.
However, some platforms restrict exports with time delays between each, such as once per 30 days on Twitter, and many platforms lack partial export options.
Other sites such as
Quora
Quora () is a social question-and-answer website based in Mountain View, California. It was founded on June 25, 2009, and made available to the public on June 21, 2010. Users can collaborate by editing questions and commenting on answers that ...
or Bumble offer no automated request form, requiring the user to request a copy of their data through a personal support
email
Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic ( digital) version of, or counterpart to, mail, at a time when "mail" meant ...
.
In consumer electronics
Mobile devices
Some
mobile app
A mobile application or app is a computer program or software application designed to run on a mobile device such as a phone, tablet, or watch. Mobile applications often stand in contrast to desktop applications which are designed to run on d ...
s restrict data portability by storing user data in locked
directories
Directory may refer to:
* Directory (computing), or folder, a file system structure in which to store computer files
* Directory (OpenVMS command)
* Directory service, a software application for organizing information about a computer network's ...
while lacking
export
An export in international trade is a good produced in one country that is sold into another country or a service provided in one country for a national or resident of another country. The seller of such goods or the service provider is an ...
options. Such may include
configuration file
In computing, configuration files (commonly known simply as config files) are computer file, files used to configure the Parameter (computer programming), parameters and Initialization (programming), initial settings for some computer programs. T ...
s,
digital bookmarks,
browsing history
Web browsing history refers to the list of web pages a user has visited, as well as associated metadata such as page title and time of visit. It is usually stored locally by web browsers in order to provide the user with a history list to go back ...
and
sessions (e.g. list of open
tabs and navigation histories), watch and search histories in multimedia
streaming apps, custom
playlists
A playlist is a list of video or audio files that can be played back on a media player either sequentially or in a shuffled order. In its most general form, an audio playlist is simply a list of songs, but sometimes a loop. The term has seve ...
in
multimedia player software, entries in
note taking
Note-taking (sometimes written as notetaking or note taking) is the practice of recording information from different sources and platforms. By taking notes, the writer records the essence of the information, freeing their mind from having to reca ...
and
memorandum
A memorandum ( : memoranda; abbr: memo; from the Latin ''memorandum'', "(that) which is to be remembered") is a written message that is typically used in a professional setting. Commonly abbreviated "memo," these messages are usually brief and ...
software, digital
phone book
A telephone is a telecommunications device that permits two or more users to conduct a conversation when they are too far apart to be easily heard directly. A telephone converts sound, typically and most efficiently the human voice, into e ...
s (
contact list
A contact list is a collection of screen names. It is a commonplace feature of instant messaging, Email clients, online games and mobile phones. It has various trademarked and proprietary names in different contexts.
Contacts lists' windows s ...
s), call logs from the telephone app, and conversations through
SMS
Short Message/Messaging Service, commonly abbreviated as SMS, is a text messaging service component of most telephone, Internet and mobile device systems. It uses standardized communication protocols that let mobile devices exchange short text ...
and
instant messaging
Instant messaging (IM) technology is a type of online chat allowing real-time text transmission over the Internet or another computer network. Messages are typically transmitted between two or more parties, when each user inputs text and trigge ...
software.
Locked directories are inaccessible to an end-user without extraordinary measures such as so-called
rooting (Android)
Rooting is the process by which users of Android devices can attain privileged control (known as root access) over various subsystems of the device, usually smartphones. Because Android is based on a modified version of the Linux kernel, rooting ...
or
jailbreaking (iOS).
The former requires the so-called
boot loader
A bootloader, also spelled as boot loader or called boot manager and bootstrap loader, is a computer program that is responsible for booting a computer.
When a computer is turned off, its softwareincluding operating systems, application code, a ...
of the device to be in an unlocked state in advance, which it usually is not by default. Toggling that state involves a full erasure of all user data, known as the ''wipe'', making it a
vicious cycle
A vicious circle (or cycle) is a complex chain of events that reinforces itself through a feedback loop, with detrimental results. It is a system with no tendency toward equilibrium (social, economic, ecological, etc.), at least in the short r ...
if the user's aim were to access their locked data.
Other mobile apps only allow the creation of user data backups using
proprietary software
Proprietary software is software that is deemed within the free and open-source software to be non-free because its creator, publisher, or other rightsholder or rightsholder partner exercises a legal monopoly afforded by modern copyright and int ...
provided by the vendor, lacking the ability to directly export the data to a local file in the mobile device's common user data directory. Such said software requires an external host computer to run on.
Some device vendors offer
cloud storage
Cloud storage is a model of computer data storage in which the digital data is stored in logical pools, said to be on "the cloud". The physical storage spans multiple servers (sometimes in multiple locations), and the physical environment is t ...
and synchronisation services for backing up data. Such services however require registration and depend on internet connection and preferably high internet speeds and data plan limits if used regularly. Some services may only allow moving parts of the data such as text messages and
phone book
A telephone is a telecommunications device that permits two or more users to conduct a conversation when they are too far apart to be easily heard directly. A telephone converts sound, typically and most efficiently the human voice, into e ...
s between locked directories on devices of the same vendor (
vendor lock-in
In economics, vendor lock-in, also known as proprietary lock-in or customer lock-in, makes a customer dependent on a vendor for products, unable to use another vendor without substantial switching costs.
The use of open standards and alternat ...
), without the ability to export the information into local files directly accessible by the end user.
Restrictions added in more recent versions of
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
s, such as ''
scoped storage'', which is claimed to have been implemented with the aim to improve user privacy, compromise both
backwards compatibility
Backward compatibility (sometimes known as backwards compatibility) is a property of an operating system, product, or technology that allows for interoperability with an older legacy system, or with input designed for such a system, especially in ...
to established existing software such as
file manager
A file manager or file browser is a computer program that provides a user interface to manage files and folders. The most common operations performed on files or groups of files include creating, opening (e.g. viewing, playing, editing or pr ...
s and
FTP server applications, as well as legitimate uses such as cross-app communication and facilitating large
file transfer File transfer is the transmission of a computer file through a communication channel from one computer system to another. Typically, file transfer is mediated by a communications protocol. In the history of computing, numerous file transfer protocol ...
s and
backup
In information technology, a backup, or data backup is a copy of computer data taken and stored elsewhere so that it may be used to restore the original after a data loss event. The verb form, referring to the process of doing so, is "back up", w ...
creation.
Further possible restraints on data portability are poor reliability, stability and performance of existing means of data transfer, such as described in .
Digital video recorders
Some
digital video recorder
A digital video recorder (DVR) is an electronic device that records video in a digital format to a disk drive, USB flash drive, SD memory card, SSD or other local or networked mass storage device. The term includes set-top boxes with direct to d ...
s (DVRs) which store recordings on an internal hard drive lack the ability to back up recordings, forcing a user to delete existing recordings upon exhausted disk space, which is an instance of poor data portability.
Some DVRs have an
operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
that depends on an Internet connection to boot and operate, meaning that recordings stored locally are inaccessible if no internet connection is available. If service for the device gets deprecated by the television service provider, the existing recordings become inaccessible and thus considerably lost.
Other appliances
Cordless landline telephone
A landline (land line, land-line, main line, home phone, fixed-line, and wireline) is a telephone connection that uses metal wires or optical fiber telephone line for transmission, as distinguished from a mobile cellular network, which uses ...
units, as well as their associated base stations, which have
firmware
In computing, firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. Firmware, such as the BIOS of a personal computer, may contain basic functions of a device, and may provide h ...
s with
phone book
A telephone is a telecommunications device that permits two or more users to conduct a conversation when they are too far apart to be easily heard directly. A telephone converts sound, typically and most efficiently the human voice, into e ...
and
SMS
Short Message/Messaging Service, commonly abbreviated as SMS, is a text messaging service component of most telephone, Internet and mobile device systems. It uses standardized communication protocols that let mobile devices exchange short text ...
messaging functionality, commonly lack an interface to connect to a computer for backing the data up.
In software
Some software such as the
''Discourse'' forum software offers a built-in ability for users to download their posts into an archive file.
Other software may operate locally, but store user data in a
proprietary format
A proprietary file format is a file format of a company, organization, or individual that contains data that is ordered and stored according to a particular encoding-scheme, designed by the company or organization to be secret, such that the decodi ...
, thus causing
vendor lock-in
In economics, vendor lock-in, also known as proprietary lock-in or customer lock-in, makes a customer dependent on a vendor for products, unable to use another vendor without substantial switching costs.
The use of open standards and alternat ...
until successfully
reverse-engineer
Reverse engineering (also known as backwards engineering or back engineering) is a process or method through which one attempts to understand through deductive reasoning how a previously made device, process, system, or piece of software accompl ...
ed by third party developers.
By country
European Union
The right to data portability was laid down in the European Union's
General Data Protection Regulation (GDPR) passed in April 2016. The regulation applies to data processors, whether inside or outside the EU, if they process data on individuals who are physically located within an EU member state.
Earlier the
European Data Protection Supervisor
The European Data Protection Supervisor (EDPS) is an independent supervisory authority whose primary objective is to monitor and ensure that European institutions and bodies respect the right to privacy and data protection when they process pers ...
had stated that data portability could "let individuals benefit from the value created by the use of their personal data".
The European-level
Article 29 Data Protection Working Party
The Article 29 Working Party (Art. 29 WP), full name "The Working Party on the Protection of Individuals with regard to the Processing of Personal Data", was an advisory body made up of a representative from the data protection authority of each ...
held a consultation on this in English lasting until the end of January 2017.
Their guidelines and FAQ on the right to data portability contain this call for action:
The French national data supervisor
CNIL hosted a discussion in French. Current participants offer opinions on how the legislation provides few benefits for companies, but many for users.
In April 2017, new guidelines were published on the Article 29 Working Party website.
In late 2019 the Data Governance Act was published by the Commission.
In 2021 researchers, many of them French and Finnish, published a 46-page report covering the state-of-the-art.
In 2022 the European Commission published the Data Act.
Although the United Kingdom
voted to withdraw from the EU, it intends to incorporate much of the GDPR in its own legislation, which will include data portability, as "...the GDPR itself contains some noteworthy innovations – for instance… the introduction of a new right to data portability".
In November at the Internet Governance Forum 2019 in Berlin panelists reported that Article 20 GDPR is not actionable, neither legally nor technically. In the UK—ironically post-Brexit—researchers are monitoring developments.
Germany has called to strengthen the European Union's right to data portability using competition law. A commission was set up for the purpose of proposing improvements.
Switzerland
Likewise, in Switzerland, a nation-state that is related to the EU only on a bilateral basis and as an
EFTA
The European Free Trade Association (EFTA) is a regional trade organization and free trade area consisting of four European states: Iceland, Liechtenstein, Norway and Switzerland. The organization operates in parallel with the European U ...
member state, there has been a trend moving in the same direction. The Swiss view was officially published in March 2018 (as a document in PDF).
An association proposed to have a right to data portability anchored in the constitution of the Swiss Confederation. A law was passed that includes data portability; as described here in German
and here in French. The association partners with a cooperative called MIDATA.coop, which will offer users a place to store their data.
A second association has issued its guideline on the topic.
Over the longer term, the Swiss may have to consider that data portability is in the GDPR. Given that the GDPR will raise compliance costs for EU-based companies, it is unlikely that the EU would tolerate a situation with third-party countries in which Swiss companies would not be held to the same standard in order to keep competition fair. The legal terms involved are adequacy and reciprocity.
United States, California
California has a Consumer Privacy Act (CCPA) of 2018, which introduces data portability to the USA.
Canada
Canada anticipates a law in that it shows Transparency, Portability and Interoperability as Principle No. 4 of its Digital Charter.
India
Data portability is included in the
Personal Data Protection Bill 2019
The Personal Data Protection Bill 2019 (PDP Bill 2019) was tabled in the Indian Parliament by the Ministry of Electronics and Information Technology on 11 December 2019. As of March 2020 the Bill is being analyzed by a Joint Parliamentary Commi ...
about to become law as section 26 in chapter VI.
Brazil
Data portability is included in the
Privacy law#Brazil as its Article 18.
Australia
In Australia a Consumer Data Right has been proposed.
Thailand
Data portability is included in the new law.
Kenya
A right to data portability is enshrined in the new data protection law under clause 34. However, the intentions behind the new law, its enforcement and relation to the government's new
Identity management system have already been contested.
Requirements for effective data interoperability
It is always tricky for legislators to regulate at the right level of precision, as everyone understands technology will evolve faster than the law. So far, only the European Union has formalized the expectations around data portability, requiring the data "in a structured, commonly used, machine-readable and interoperable format".
This touches on at least two distinct technical requirements for effective interoperability:
* the need to use file standards that allow for easy reuse (for instance CSV or JSON instead of PDF or even printed paper), encompassed by a "structured, commonly used, machine-readable" format.
* the need (hinging on "interoperable") to not only consider an individual's data release on its own, but also in conjunction with other systems and other individuals' data releases from the same company. This hints at requirements regarding data schemas, versioning and specification of those schemas in case of frequent changes, and generally the absence of efforts on the part of the source data controller to complicate the effective interoperability downstream.
Likewise, European researchers stress that there are both practical and legal gaps that the EU should fill.
Rights of data subjects under the European Union's new GDPR
The list of these rights has grown.
Data portability in relation to the right of access
The data portability right is slightly different from the
Right of access to personal data
The right of access, also referred to as right to access and (data) subject access, is one of the most fundamental rights in data protection laws around the world. For instance, the United States, Singapore, Brazil, and countries in Europe have all ...
; see
GDPR
The General Data Protection Regulation (GDPR) is a European Union regulation on data protection and privacy in the EU and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and of human rights law, in parti ...
and the seventh item in the list cited immediately above. The right of access only mandates that the data subject gets to see their personal data. The old EU Data Protection Directive used to require explicitly in such cases for the data to be provided in "intelligible" form, which has been interpreted so far as "human readable". This requirement is still somewhat present in the EU's General Data Protection Regulation, but only implicitly in conjunction with
Recital (law) In law, a recital (from la, recitare, "to read out") consists of an account or repetition of the details of some act, proceeding or fact. Particularly, in law, that part of a legal document—such as a lease, which contains a statement of certain f ...
. Since the right to portability is mostly concerned with reuse by other services (i.e. most likely automated), it could be that both "human readable" and "raw format" would be inappropriate for effective data portability. Some intermediate level might need to be sought.
In addition, the GDPR limits the scope of data portability to cases where the processing is made on the basis of either consent of the data subject, or the performance of a contract.
Data portability in relation to the right of explanation
The data portability right is related to the "
right to explanation
In the regulation of algorithms, particularly artificial intelligence and its subfield of machine learning, a right to explanation (or right to ''an'' explanation) is a right to be given an explanation for an output of the algorithm. Such rights p ...
", i.e. when automated decisions are made that have legal effect or significant impact on individual data subjects. How to display an algorithm? One way is through a
decision tree
A decision tree is a decision support tool that uses a tree-like model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility. It is one way to display an algorithm that only contains condit ...
. This right, however, was found to be not very useful in an empirical study.
The right to explanation is related to the "Right to not be evaluated on the basis of automated processing" shown as the last item in the list shown in Gabel / Hickman. This includes decisions based on
profiling. Such a right was included in the EU Data Protection Directive of 1995, but not much enforcement followed. An article in ''Wired'' emphasised the poignancy of the discussion. The issue has been discussed by Bygrave, and by Hildebrandt, who claimed this to be one of the most important transparency rights in the era of machine learning and
big data
Though used sometimes loosely partly because of a lack of formal definition, the interpretation that seems to best describe Big data is the one associated with large body of information that we could not comprehend when used only in smaller am ...
. Contrary to Hildebrandt's high expectations in 2012, four years later, after many revisions to the GDPR, when the text has been finalized, three other well-known authors contest whether a right to explanation still exists in the GDPR (see below).
In the United States there was a description of related developments in a seminal book by law professor Frank Pasquale; the relevant passages were reviewed by the Electronic Privacy Information Center (EPIC). Even the U.S. Defense Advanced Research Projects Agency DARPA has an
Explainable AI
Explainable AI (XAI), or Interpretable AI, or Explainable Machine Learning (XML), is artificial intelligence (AI) in which humans can understand the decisions or predictions made by the AI. It contrasts with the "black box" concept in machine lear ...
(XAI) program
cited critically by blogger Artur Kiulian.
Several papers have been published on these topics in 2016, the first of which, by Goodman / Flaxman, outlines the development of the right to explanation. Pasquale does not think the approach goes far enough, as he has stated in a blog entry at the
London School of Economics
, mottoeng = To understand the causes of things
, established =
, type = Public research university
, endowment = £240.8 million (2021)
, budget = £391.1 millio ...
(LSE). In fact at LSE there is a whole series on Algorithmic Accountability of which that was one entry in Feb. of 2016, and other notable ones were by Joshua Kroll and
Mireille Hildebrandt.
Another 2016 paper, this one published by Katarinou et al., includes remarks on a right of appeal such that "individuals would have a right to appeal to a machine against a decision made by a human."
A third 2016 paper, one co-authored by Mittelstadt et al., maps the literature and relates it to the GDPR on its pages 13–14.
A fourth paper, one co-authored by Wachter, Mittelstadt and Floridi, refutes the idea that such a right might be included in the GDPR, proposes a limited ‘right to be informed’ instead and calls for the creation of an agency to implement the transparency requirement. A further paper by Edwards and Veale claims such a right is unlikely to apply in the cases of the 'algorithmic harms' attracting recent media attention, and that insufficient attention has been paid to both the computer science literature on explanation and how other GDPR provisions, such as data protection impact assessments and data portability, might help. Almost two years later a paper appeared that challenges earlier papers, especially Wachter / Mittelstadt / Floridi.
On both sides of the Atlantic there has been recent activity pertaining to this ongoing debate. Early in 2016 experts on artificial intelligence and UK government officials met during a number of meetings, and developed a Data Science Ethical Framework. On November 7, 2016 an event was held in Brussels, organized by MEP Marietje Schaake in the European Parliament and described by danah Boyd. Only eleven days later at New York University there was a conference on "Fairness, Accountability, and Transparency in Machine Learning " where Principles for Accountable Algorithms and a Social Impact Statement for Algorithms were articulated and placed online for discussion. By mid-December the IEEE came out with a document whose editing was backed up by public comments that were invited by March 2017 on "Ethically Aligned Design".
Later in 2017 data portability was analysed by professors of data protection as a central innovation of the new GDPR.
See also
External wikiGDPR Hub maintained by Max Schrems et al.
*
Data Transfer Project
The Data Transfer Project (DTP) is an open-source initiative which features data portability between multiple online platforms. The project was launched and introduced by Google on July 20, 2018, and has currently partnered with Facebook, Micro ...
*
Ethics of artificial intelligence
The ethics of artificial intelligence is the branch of the ethics of technology specific to artificially intelligent systems. It is sometimes divided into a concern with the moral behavior of ''humans'' as they design, make, use and treat artific ...
*
General Data Protection Regulation
Notes
References
{{Reflist
Digital rights
Interoperability